VULNERABILITY ASSESSMENT & PENETRATION TESTING: Test how your systems could be compromised.
VAPT combines vulnerability assessment with controlled penetration testing across selected applications and infrastructure. We examine exposed services, access controls and possible attack paths, then document validated findings and practical corrective options. Subdux can carry out agreed fixes or work with your engineers, with follow-up testing defined around the changes made.
Give the assessment a clear reason to exist.
The reason for testing should shape its scope. A customer requirement, a major release and a concern about internal access may each call for a different assessment.
A customer needs independent assurance.
Establish which systems, testing dates and reporting details the customer expects before commissioning the work.
A release changes what users can do.
Review new functionality, permissions and integrations while there is still time to resolve findings before wider use.
Your environment has changed.
New infrastructure, remote access or service connections can create exposure that an earlier assessment did not examine.
Previous findings need a closer look.
Investigate uncertain results, check corrective changes or examine how several weaknesses could work together.
Choose the systems and perspectives that matter.
An engagement can focus on one application or combine several parts of your environment. We define the targets, available access and permitted techniques before testing begins.
Applications and APIs
Test sign-in, permissions, sensitive workflows and the handling of data across agreed user roles and interfaces.
External infrastructure
Examine the services reachable from outside your organisation, including their exposure, configuration and relevant known weaknesses.
Internal infrastructure
Investigate what an agreed starting position inside the network could reach, and whether access boundaries prevent further movement.
Connected services
Include relevant cloud resources and integrations where they form part of the assessment, with permissions and third-party boundaries established in advance.
The starting conditions change what a test can tell you.
Access
Testing without credentials examines one perspective. Providing accounts for different roles allows a closer examination of permissions and activity available after sign-in.
Environment
A representative test environment can support deeper investigation. Where production testing is needed, we agree appropriate techniques, test windows and escalation contacts.
Constraints
We record excluded systems and activities, operational restrictions and any dependencies that affect coverage. These boundaries remain visible in the final report.
Findings that support the corrective work.
The report should explain what was tested, what the assessment established and where further work is needed.
An overview for decision-makers
The main findings and their implications, with the tested scope and limitations made clear.
Details for investigation and repair
Affected assets, supporting evidence, relevant reproduction details and an explanation of the conditions behind each finding.
Corrective actions in context
Recommended changes that account for the way the affected systems are used and the dependencies involved.
A route through follow-up work
We can help implement changes and reassess the affected areas. Remediation responsibilities and retesting are defined in the engagement scope.
Is VAPT the same as a vulnerability scan?
A scan can identify potential weaknesses across many targets. Penetration testing adds investigation and controlled attempts to establish how selected weaknesses could be used. The balance of coverage and depth depends on the systems and agreed scope.
Do we need to provide accounts or source code?
That depends on what you need assessed. Test accounts help examine signed-in activity and different permission levels. Source code can support a deeper implementation review, but it should be included explicitly rather than assumed to be part of every test.
Can you test a live system?
Production testing may be appropriate, subject to the system's operating requirements and agreed restrictions. We discuss potential impact, test windows and escalation arrangements before deciding how to proceed.
Will this satisfy a customer or audit requirement?
Share the requirement before the assessment is scoped. We can map the requested coverage and reporting to the proposed work. The party requesting the assessment determines whether it meets their requirements.
Can Subdux fix what it finds?
Yes. We can support implementation or work directly on agreed corrective changes. We define ownership, system access and follow-up testing as part of that work.
What needs to be tested, and why now?
Share the systems involved, any external requirements and the dates you are working towards. We will help define an assessment that addresses the question behind your enquiry.
Related services: Web Application Security Testing and Continuous Vulnerability & Exposure Management.